Harden request origin checks and configure allowed hosts

docs/local-network.md

@@ -0,0 +1,41 @@
+# Using MineGeo on a Mac or another LAN server
+
+MineGeo validates browser requests against the hostname and port used to reach
+the server. The internal Next.js listening address can differ from that address.
+Supabase's email redirect settings do not configure MineGeo's origin validation.
+
+In the server's `.env.local`, set the public URL to the address you actually use.
+For example, if the Mac is `192.168.1.50` and MineGeo runs on port `3000`:
+
+```dotenv
+MINEGEO_URL=http://192.168.1.50:3000
+# Needed only if other devices access the Mac over the LAN:
+MINEGEO_HOST=0.0.0.0
+```
+
+Use your own IP address and port, then restart MineGeo. `MINEGEO_URL` also controls
+the browser pairing link generated for the capture tools.
+
+In Supabase **Authentication → URL Configuration**, use the same base address for
+the Site URL and add `http://192.168.1.50:3000/auth/callback` to Redirect URLs.
+MineGeo sends the current browser origin plus `/auth/callback` when requesting an
+email sign-in link. After changing redirect settings, request a fresh link.
+See [Supabase's redirect URL documentation](https://supabase.com/docs/guides/auth/redirect-urls).
+
+For a reverse proxy whose public scheme or hostname differs from the backend,
+set `MINEGEO_URL` to the public HTTPS URL. Additional exact origins can be listed
+in `MINEGEO_ALLOWED_ORIGINS`, separated by commas. Arbitrary forwarded-host headers
+do not authorize additional origins.
+
+For a testing server reached through changing IP addresses, ports, or domains,
+add this to its `.env.local` and restart MineGeo:
+
+```dotenv
+MINEGEO_ALLOW_ANY_ORIGIN=true
+```
+
+This bypasses MineGeo's browser origin checks, including their CSRF protection.
+The default is `false`; only the exact value `true` enables the bypass.
+Authentication, permissions, and JSON request requirements still apply. This
+setting controls MineGeo's API checks; Supabase email sign-in still needs allowed
+redirect URLs, and `MINEGEO_URL` still controls capture-tool pairing links.